CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam Database for Contact Form 7 allows Stored XSS.This issue affects Database for Contact Form 7: from n/a through 3.0.6.
Explanation of Vulnerability in Simple Terms
Database for Contact Form 7 versions up to 3.0.6 contain a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts into the database through form submissions. When site administrators or users view the stored data, the scripts execute in their browsers, potentially compromising their accounts or stealing sensitive information.
What an attacker can do
Inject malicious scripts that execute when administrators view stored form data in the plugin.
Potential impact on your site
Attackers can steal admin session tokens, modify site content, or redirect users to malicious sites via stored XSS.
Conditions required to exploit
User interaction required: a site admin must view the affected form data in the plugin interface.
Key dates
External resources
Related vulnerabilities
